Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
MyFonts is a web font hosting service by Monotype that delivers fonts from a content delivery network and counts pageviews for licensing, transmitting visitor IP and referrer to the United States.
MyFonts is a web font hosting service operated by Monotype, a company based in the United States. When a website embeds a MyFonts web font kit, the fonts are delivered from a content delivery network so they load quickly for visitors anywhere.
To enforce licensing, the service counts pageviews each time a page that uses the font kit is loaded, which involves contact with Monotype infrastructure.
When a font is loaded, the visitor browser sends its IP address and the referring page address to a tracking service so a pageview can be counted against the licence. According to Monotype, the IP address is used to count pageviews and is not stored or further processed by the provider for other purposes.
The font delivery itself is cookieless, but the IP address is personal data under the GDPR, so the transmission still constitutes processing that must be justified.
Loading fonts from an external United States service exposes the visitor IP address to a third country, which European courts and regulators have treated as a sensitive point, as shown by decisions on external Google Fonts. The website operator is the controller and must be able to justify the transfer.
Because the IP is read from the device on each request, the safest approach treats external font loading as requiring user consent rather than relying solely on legitimate interest.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Given the transfer of IP data abroad, many European operators ask for consent before loading MyFonts from the external service. The consent banner should explain that an external font provider in the United States will receive the IP address, and it must offer a genuine option to refuse.
Where consent is refused, the site should fall back to locally hosted fonts so the page still renders without contacting the external service.
The IP address and referrer are transmitted to the United States. Such transfers should rely on the EU US Data Privacy Framework where Monotype is certified, or on Standard Contractual Clauses together with a transfer impact assessment that considers United States surveillance laws.
Prefer self hosting the licensed font files on your own server or European CDN so no visitor IP leaves to the United States. If you keep the external service, gate it behind consent, verify the transfer mechanism, and update your privacy notice to name Monotype and describe the IP transfer.
Keep records of your transfer assessment and your consent logs so you can demonstrate accountability if a supervisory authority asks.
Websites using MyFonts must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is strongly advisable for MyFonts web font hosting because the service transmits visitor IP addresses to a provider in the United States for pageview counting. The combination of an international transfer and tracking on every page view raises the risk profile, even though the provider states it does not store the IP for other purposes.
Sample consent text
This site can load fonts from MyFonts by Monotype, which sends your IP address and the page address to a service in the United States to count pageviews for licensing. We only load these external fonts with your consent, which you can refuse or withdraw at any time, in which case locally hosted fonts are used.
Third-party domains contacted
myfonts.comhello.myfonts.netfast.fonts.netmonotype.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| monotype_session | Strictly necessary | Session | Maintains the session on the Monotype and MyFonts web properties. |
| mt_consent | Functional | 1 year | Stores the cookie consent choices made on the provider website. |
| mt_prefs | Functional | 6 months | Remembers display and language preferences on the provider website. |
| _mt_ga | Analytics | 13 months | Measures usage of the provider website for reporting purposes. |
MyFonts is an essential service, but transparency matters. Manage all your consent with FlowConsent.
The MyFonts web font hosting and pageview tracking are cookieless, since the service identifies pageviews through the request rather than a stored cookie. The myfonts.com website itself uses session, preference and analytics cookies, but these are separate from the embedded font kit on your site.
Because loading the external fonts sends the visitor IP address to the United States, the safest approach is to ask for consent before the font request. If you self host the licensed font files instead, no IP leaves to the provider and the consent question for fonts disappears.
Monotype relies on legitimate interest under Art. 6(1)(f) GDPR for pageview counting, but for the website operator the international transfer makes consent under Art. 6(1)(a) GDPR the more defensible basis. Self hosting avoids the question by keeping data within the EU.
Yes, when fonts are loaded from the external service the visitor IP address and referrer are transmitted to the United States. Such transfers should rely on the EU US Data Privacy Framework or on Standard Contractual Clauses with a transfer impact assessment.
A DPIA is strongly advisable because the service combines an international transfer of IP data with tracking on every page view. Documenting the risk and the chosen safeguards helps demonstrate that the transfer has been properly assessed.
The cleanest approach is to self host the licensed font files on your own server or a European CDN so no visitor IP reaches the United States. If you keep the external service, gate it behind consent, verify the transfer mechanism, and describe the IP transfer in your privacy notice.
Alternatives include self hosting the same licensed fonts, using European web font providers, or relying on system and open source fonts that load without any external request. These options reduce or remove the transfer of visitor IP data.
Since the embedded fonts are cookieless, focus your privacy notice on the IP transfer to Monotype in the United States, its purpose and its legal basis, rather than on cookies. If you self host instead, state that fonts are served locally and that no data is sent to the provider.